Beast 2.02(a)
(Backdoor.Win32.Beastdoor.202.a)

by Tataye

Successor of  Ulysses

Written in Delphi

Released in September 2003

Made in Rumania

more versions



New features:
   - multithreaded client/server (few tasks in the same time)
   - multibinder with a 6.x kB stub, coded in Delphi7 :P
   - ICQ2003 password support
   - run appz and receive output (app redirect)
   - download directories
   - skins 

Improvements:
   - speeded up all the transfers with ~40%
   - smart port listening (i.e. if the port is used, find another)
   - smaller servers :P
   - XP firewall service stop and disable
   - better on-line checking
   - and others more subtle

Fixes:
   - no security hole, cracking isn't possible anymore
   - no more IP/Port Scanner crashes
   - clipboard manager (no errors if the clipboard data is big)
   - screen manager (the images can be saved in any directory)
   - etc.

Issues:
   - with beast 2.02 you CAN'T connect to older servers!

Tataye   


Client:
registry keys added:
HKEY_CLASSES_ROOT\.bad 
HKEY_CLASSES_ROOT\.bst 
HKEY_CLASSES_ROOT\BeastFile 
HKEY_CLASSES_ROOT\BeastFile\DefaultIcon 
HKEY_CLASSES_ROOT\BeastFile\shell 
HKEY_CLASSES_ROOT\BeastFile\shell\open 
HKEY_CLASSES_ROOT\BeastFile\shell\open\command 
HKEY_CLASSES_ROOT\BeastFile1 
HKEY_CLASSES_ROOT\BeastFile1\DefaultIcon 
HKEY_CLASSES_ROOT\BeastFile1\shell 
HKEY_CLASSES_ROOT\BeastFile1\shell\open 
HKEY_CLASSES_ROOT\BeastFile1\shell\open\command 



Server:
dropped files:
c:\WINDOWS\svchost.exe 
c:\WINDOWS\SYSTEM\mshlir.com 
c:\WINDOWS\COMMAND\mswnqu.com 

size: 50.782 bytes

port: 6666 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "COM Service" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{42AC0312-EE51-A3CC-EA32-40AA12E6115C} "StubPath" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "COM Service" 

added:
c:\WINDOWS\SYSTEM\hlir.blf 
MegaSecurity